Menu
Microsoft fixes critical flaws in Windows, Office, Edge, IE and other products

Microsoft fixes critical flaws in Windows, Office, Edge, IE and other products

The company published 9 security bulletins covering patches for 24 vulnerabilities

Microsoft has released the first batch of security updates for 2016 and they include critical fixes for remote code execution flaws in Windows, Office, Edge, Internet Explorer, Silverlight and Visual Basic.

The company has also fixed remote code execution and elevation of privilege vulnerabilities in Windows and an address spoofing flaw in Exchange Server, that were rated important, not critical, due to various mitigating factors.

In total, Microsoft issued 9 security bulletins covering patches for 24 vulnerabilities.

According to Wolfgang Kandek, the CTO of security firm Qualys, administrators should prioritize the MS16-005 security bulletin, especially for systems running Windows Vista, 7 and Server 2008.

This patch addresses a remote code execution vulnerability tracked as CVE-2016-0009 that has been publicly disclosed, making attacks more likely.

The second most important bulletin, according to Qualys, is MS16-004, which addresses six vulnerabilities in Microsoft Office. This bulletin is rated critical, which has been unusual for Microsoft Office in the recent past.

The culprit for this severity rating is one particular remote code execution vulnerability tracked as CVE-2016-0010 that's present in all versions of Office from 2007 to 2016, even those running on Mac and Windows RT, Kandek said in a blog post.

Researchers from security firm Tripwire believe that the Internet Explorer and Microsoft Edge patches should be at the top of the priority list instead, because they address vulnerabilities that could be remotely exploited through malicious or compromised websites.

These patches are covered in the MS16-001 and MS16-002 security bulletins and will be the last ones that Internet Explorer versions 8 and 10 will ever receive. IE 9 will continue to be supported on Windows Vista and Windows Server 2008 SP2.

"Many enterprises need to use older versions of IE within their environments because of very expensive, legacy web applications that use outdated technology," said Lane Thames, security researcher at Tripwire, via email. "Organizations who still depend on legacy applications that require these older IE versions will need to move appropriately."

Companies that use Outlook Web Access (OWA) should also prioritize MS16-010. Even though this bulletin is rated by Microsoft only as important, the vulnerability it covers can allow attackers to launch so-called business e-mail compromise (BEC) attacks.

Such attacks have cost companies around the world $1.2 billion, according to statistics published in August by the FBI's Internet Crime Complaint Center (IC3). It involves attackers compromising business emails, or spoofing email addresses, to instruct employees and business partners to initiate unauthorized wire transfers.

Finally, the MS16-006 bulletin, which addresses a vulnerability in Silverlight, should be on the priority list as well because the flaw could enable remote code execution attacks through the browser plug-in. Attackers are known to have used Silverlight exploits in the past.

This month's updates were also the last ones for Windows 8, which Microsoft will no longer support going forward. Windows 8 users will have to upgrade to Windows 8.1 or 10 in order to continue receiving security patches.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Featured

Slideshows

Meet the leading female front runners of the Kiwi channel

Meet the leading female front runners of the Kiwi channel

Reseller News honoured the leading female front runners of the New Zealand channel at the 2018 Women in ICT Awards (WIICTA) in Auckland. The awards honoured standout individuals across seven categories, spanning Entrepreneur; Innovation; Rising Star; Shining Star; Community; Technical and Achievement.

Meet the leading female front runners of the Kiwi channel
Meet the top performing customer-centric Microsoft channel partners

Meet the top performing customer-centric Microsoft channel partners

Microsoft honoured leading partners across the channel following a year of customer innovation and market growth in New Zealand. The 2018 Microsoft Partner Awards recognised excellence within the context of the end-user, spanning a host of emerging and established providers.

Meet the top performing customer-centric Microsoft channel partners
Reseller News launches new-look Awards at 2018 Judges’ Lunch

Reseller News launches new-look Awards at 2018 Judges’ Lunch

Introducing the Reseller News Innovation Awards, launched to the channel at the 2018 Judges’ Lunch in Auckland. With more than 70 judges now part of the voting panel, the new-look awards will reflect the changing dynamics of the channel, recognising excellence across customer value and innovation - spanning start-ups, partners, distributors and vendors.

Reseller News launches new-look Awards at 2018 Judges’ Lunch
Show Comments